CN107220132B - Method, equipment and storage medium for monitoring file creation information - Google Patents

Abstract

The invention discloses a method, a device and a storage medium for monitoring file creation information, wherein the method comprises the following steps: monitoring the file creating operation of the bottom layer through a monitoring program added to the bottom layer, and acquiring the ID of the application program for creating the file; obtaining the package name of the application program for creating the file according to the ID of the application program; and sending a notification message that the application program corresponding to the packet name carries out file creation to the specified monitoring registrant. The method, the device and the storage medium for monitoring the file creation information can enable an external management program to obtain the number of files created by the application program, so that more use methods are derived.

Description

Method, equipment and storage medium for monitoring file creation information

Technical Field

The present invention relates to the field of network application technologies, and in particular, to a method, a device, and a storage medium for monitoring file creation information.

Background

The Nubia shield is a piece of security management software launched by the Nubia official, and besides protecting the security and secrecy of users, intercepting harassment, saving money and traffic, and accelerating the speed of mobile phones, the Nubia shield also provides the function of retrieving the mobile phones.

In order to better support such a hypervisor as the bovine shield, it is necessary to provide a query means that allows the hypervisor to selectively query how many files a specific application creates within a certain period of time, and even what files are created specifically. For example, we want to know how many files the QQ application created over a period of time. On the current Android system, we cannot achieve our purpose by querying Media Provider, because there is no "creator" information of files in Media Provider, so it cannot know which files on SD card are QQ generated.

Disclosure of Invention

In view of the above problems, the present invention provides a method, an apparatus, and a storage medium for monitoring file creation information, which enable an external management program to obtain the number of files created by an application program.

The method for monitoring the file creation information provided by the invention comprises the following steps:

monitoring the file creating operation of the bottom layer through a monitoring program added to the bottom layer, and acquiring the ID of the application program for creating the file;

obtaining the package name of the application program for creating the file according to the ID of the application program;

and sending a notification message that the application program corresponding to the package name carries out file creation to a specified monitoring registrant.

As a further improvement of the present invention, when monitoring the file creating operation of the bottom layer, the method for monitoring the file creating information of the present invention further includes: acquiring the name of a created file;

further, the notification message further includes: the name of the file is created.

Specifically, the monitoring of the file creation operation of the bottom layer includes:

and when the file creating function in the underlying library is monitored to be called, judging that the file creating operation is monitored.

As a further improvement of the present invention, the method for monitoring file creation information of the present invention, after obtaining a package name of an application program that creates a file according to an ID of the application program, further includes:

saving one or more of the following: an ID of an application that created the file, a package name of an application that created the file, and a name of the created file.

The information stored in the invention can be used for statistics, for example, the information can be used for counting the number of files created and deleted by any application program in a certain period of time and informing the external world.

Specifically, in the method for monitoring file creation information of the present invention, the designated monitor registrant includes: and the external management program is used for carrying out monitoring registration in advance and giving an instruction of the application program needing monitoring.

The invention also provides a monitoring device of the file creation information, which comprises: a memory, a processor and a computer program stored on the memory and executable on the processor, the computer program when executed by the processor implementing the steps of:

monitoring the file creating operation of the bottom layer through a monitoring program added to the bottom layer, and acquiring the ID of the application program for creating the file;

obtaining the package name of the application program for creating the file according to the ID of the application program;

and sending a notification message that the application program corresponding to the package name carries out file creation to a specified monitoring registrant.

As a further improvement of the present invention, in the monitoring device for file creation information of the present invention, the computer program is executed by the processor, and when monitoring the file creation operation of the bottom layer, the following steps are further implemented:

monitoring the bottom file creating operation to obtain the name of the created file;

the notification message further comprises: the name of the file is created.

As a further improvement of the present invention, in the monitoring device for file creation information of the present invention, when executed by the processor, the computer program specifically implements the following steps:

and when the file creating function in the underlying library is monitored to be called, judging that the file creating operation is monitored.

In the monitoring device for file creation information according to the present invention, when the computer program is executed by the processor, after obtaining a package name of an application program that creates a file according to the ID of the application program, the following steps are further implemented:

saving one or more of the following: an ID of an application that created the file, a package name of an application that created the file, and a name of the created file.

The invention also provides a storage medium, wherein the storage medium is stored with a monitoring program of the file creation information, and the monitoring program of the file creation information realizes the steps of the monitoring method of the file creation information when being executed by a processor.

The invention has the following beneficial effects:

the method, the device and the storage medium for monitoring the file creation information can obtain the ID of the application program for creating the file by monitoring the operation for creating the file, obtain the package name of the application program according to the ID of the application program, and send the notification message that the application program corresponding to the package name carries out file creation to the appointed monitoring registrant, so that an external management program can obtain the number of files created by the application program, and can further carry out big data analysis, thereby deriving more usages.

Drawings

Fig. 1 is a schematic diagram of a hardware structure of a mobile terminal implementing various embodiments of the present invention;

fig. 2 is a diagram of a communication network system architecture according to an embodiment of the present invention;

fig. 3 is a flowchart of a method for monitoring file creation information according to a first embodiment of the present invention;

fig. 4 is a schematic structural diagram of a first embodiment of the present invention.

Detailed Description

It should be understood that the specific embodiments described herein are merely illustrative of the invention and are not intended to limit the invention.

In the following description, suffixes such as "module", "component", or "unit" used to denote elements are used only for facilitating the explanation of the present invention, and have no specific meaning in itself. Thus, "module", "component" or "unit" may be used mixedly.

The terminal may be implemented in various forms. For example, the terminal described in the present invention may include a mobile terminal such as a mobile phone, a tablet computer, a notebook computer, a palmtop computer, a Personal Digital Assistant (PDA), a Portable Media Player (PMP), a navigation device, a wearable device, a smart band, a pedometer, and the like, and a fixed terminal such as a Digital TV, a desktop computer, and the like.

The following description will be given by way of example of a mobile terminal, and it will be understood by those skilled in the art that the construction according to the embodiment of the present invention can be applied to a fixed type terminal, in addition to elements particularly used for mobile purposes.

Referring to fig. 1, which is a schematic diagram of a hardware structure of a mobile terminal for implementing various embodiments of the present invention, themobile terminal 100 may include: RF (Radio Frequency)unit 101,WiFi module 102,audio output unit 103, a/V (audio/video)input unit 104,sensor 105,display unit 106,user input unit 107,interface unit 108,memory 109,processor 110, andpower supply 111. Those skilled in the art will appreciate that the mobile terminal architecture shown in fig. 1 is not intended to be limiting of mobile terminals, which may include more or fewer components than those shown, or some components may be combined, or a different arrangement of components.

The following describes each component of the mobile terminal in detail with reference to fig. 1:

theradio frequency unit 101 may be configured to receive and transmit signals during information transmission and reception or during a call, and specifically, receive downlink information of a base station and then process the downlink information to theprocessor 110; in addition, the uplink data is transmitted to the base station. Typically,radio frequency unit 101 includes, but is not limited to, an antenna, at least one amplifier, a transceiver, a coupler, a low noise amplifier, a duplexer, and the like. In addition, theradio frequency unit 101 can also communicate with a network and other devices through wireless communication. The wireless communication may use any communication standard or protocol, including but not limited to GSM (Global System for Mobile communications), GPRS (General Packet Radio Service), CDMA2000(Code Division Multiple Access 2000), WCDMA (Wideband Code Division Multiple Access), TD-SCDMA (Time Division-Synchronous Code Division Multiple Access), FDD-LTE (Frequency Division duplex Long Term Evolution), and TDD-LTE (Time Division duplex Long Term Evolution).

WiFi belongs to short-distance wireless transmission technology, and the mobile terminal can help a user to receive and send e-mails, browse webpages, access streaming media and the like through theWiFi module 102, and provides wireless broadband internet access for the user. Although fig. 1 shows theWiFi module 102, it is understood that it does not belong to the essential constitution of the mobile terminal, and may be omitted entirely as needed within the scope not changing the essence of the invention.

Theaudio output unit 103 may convert audio data received by theradio frequency unit 101 or theWiFi module 102 or stored in thememory 109 into an audio signal and output as sound when themobile terminal 100 is in a call signal reception mode, a call mode, a recording mode, a voice recognition mode, a broadcast reception mode, or the like. Also, theaudio output unit 103 may also provide audio output related to a specific function performed by the mobile terminal 100 (e.g., a call signal reception sound, a message reception sound, etc.). Theaudio output unit 103 may include a speaker, a buzzer, and the like.

The a/V input unit 104 is used to receive audio or video signals. The a/V input Unit 104 may include a Graphics Processing Unit (GPU) 1041 and amicrophone 1042, theGraphics processor 1041 Processing image data of still pictures or video obtained by an image capturing device (e.g., a camera) in a video capturing mode or an image capturing mode. The processed image frames may be displayed on thedisplay unit 106. The image frames processed by thegraphic processor 1041 may be stored in the memory 109 (or other storage medium) or transmitted via theradio frequency unit 101 or theWiFi module 102. Themicrophone 1042 may receive sounds (audio data) via themicrophone 1042 in a phone call mode, a recording mode, a voice recognition mode, or the like, and may be capable of processing such sounds into audio data. The processed audio (voice) data may be converted into a format output transmittable to a mobile communication base station via theradio frequency unit 101 in case of a phone call mode. Themicrophone 1042 may implement various types of noise cancellation (or suppression) algorithms to cancel (or suppress) noise or interference generated in the course of receiving and transmitting audio signals.

Themobile terminal 100 also includes at least onesensor 105, such as a light sensor, a motion sensor, and other sensors. Specifically, the light sensor includes an ambient light sensor that can adjust the brightness of thedisplay panel 1061 according to the brightness of ambient light, and a proximity sensor that can turn off thedisplay panel 1061 and/or a backlight when themobile terminal 100 is moved to the ear. As one of the motion sensors, the accelerometer sensor can detect the magnitude of acceleration in each direction (generally, three axes), can detect the magnitude and direction of gravity when stationary, and can be used for applications of recognizing the posture of a mobile phone (such as horizontal and vertical screen switching, related games, magnetometer posture calibration), vibration recognition related functions (such as pedometer and tapping), and the like; as for other sensors such as a fingerprint sensor, a pressure sensor, an iris sensor, a molecular sensor, a gyroscope, a barometer, a hygrometer, a thermometer, and an infrared sensor, which can be configured on the mobile phone, further description is omitted here.

Thedisplay unit 106 is used to display information input by a user or information provided to the user. TheDisplay unit 106 may include aDisplay panel 1061, and theDisplay panel 1061 may be configured in the form of a Liquid Crystal Display (LCD), an Organic Light-Emitting Diode (OLED), or the like.

Theuser input unit 107 may be used to receive input numeric or character information and generate key signal inputs related to user settings and function control of the mobile terminal. Specifically, theuser input unit 107 may include atouch panel 1071 andother input devices 1072. Thetouch panel 1071, also referred to as a touch screen, may collect a touch operation performed by a user on or near the touch panel 1071 (e.g., an operation performed by the user on or near thetouch panel 1071 using a finger, a stylus, or any other suitable object or accessory), and drive a corresponding connection device according to a predetermined program. Thetouch panel 1071 may include two parts of a touch detection device and a touch controller. The touch detection device detects the touch direction of a user, detects a signal brought by touch operation and transmits the signal to the touch controller; the touch controller receives touch information from the touch sensing device, converts the touch information into touch point coordinates, sends the touch point coordinates to theprocessor 110, and can receive and execute commands sent by theprocessor 110. In addition, thetouch panel 1071 may be implemented in various types, such as a resistive type, a capacitive type, an infrared ray, and a surface acoustic wave. In addition to thetouch panel 1071, theuser input unit 107 may includeother input devices 1072. In particular,other input devices 1072 may include, but are not limited to, one or more of a physical keyboard, function keys (e.g., volume control keys, switch keys, etc.), a trackball, a mouse, a joystick, and the like, and are not limited to these specific examples.

Further, thetouch panel 1071 may cover thedisplay panel 1061, and when thetouch panel 1071 detects a touch operation thereon or nearby, thetouch panel 1071 transmits the touch operation to theprocessor 110 to determine the type of the touch event, and then theprocessor 110 provides a corresponding visual output on thedisplay panel 1061 according to the type of the touch event. Although thetouch panel 1071 and thedisplay panel 1061 are shown in fig. 1 as two separate components to implement the input and output functions of the mobile terminal, in some embodiments, thetouch panel 1071 and thedisplay panel 1061 may be integrated to implement the input and output functions of the mobile terminal, and is not limited herein.

Theinterface unit 108 serves as an interface through which at least one external device is connected to themobile terminal 100. For example, the external device may include a wired or wireless headset port, an external power supply (or battery charger) port, a wired or wireless data port, a memory card port, a port for connecting a device having an identification module, an audio input/output (I/O) port, a video I/O port, an earphone port, and the like. Theinterface unit 108 may be used to receive input (e.g., data information, power, etc.) from external devices and transmit the received input to one or more elements within themobile terminal 100 or may be used to transmit data between themobile terminal 100 and external devices.

Thememory 109 may be used to store software programs as well as various data. Thememory 109 may mainly include a storage program area and a storage data area, wherein the storage program area may store an operating system, an application program required by at least one function (such as a sound playing function, an image playing function, etc.), and the like; the storage data area may store data (such as audio data, a phonebook, etc.) created according to the use of the cellular phone, and the like. Further, thememory 109 may include high speed random access memory, and may also include non-volatile memory, such as at least one magnetic disk storage device, flash memory device, or other volatile solid state storage device.

Theprocessor 110 is a control center of the mobile terminal, connects various parts of the entire mobile terminal using various interfaces and lines, and performs various functions of the mobile terminal and processes data by operating or executing software programs and/or modules stored in thememory 109 and calling data stored in thememory 109, thereby performing overall monitoring of the mobile terminal.Processor 110 may include one or more processing units; preferably, theprocessor 110 may integrate an application processor, which mainly handles operating systems, user interfaces, application programs, etc., and a modem processor, which mainly handles wireless communications. It will be appreciated that the modem processor described above may not be integrated into theprocessor 110.

Themobile terminal 100 may further include a power supply 111 (e.g., a battery) for supplying power to various components, and preferably, thepower supply 111 may be logically connected to theprocessor 110 via a power management system, so as to manage charging, discharging, and power consumption management functions via the power management system.

Although not shown in fig. 1, themobile terminal 100 may further include a bluetooth module or the like, which is not described in detail herein.

In order to facilitate understanding of the embodiments of the present invention, a communication network system on which the mobile terminal of the present invention is based is described below.

Referring to fig. 2, fig. 2 is an architecture diagram of a communication Network system according to an embodiment of the present invention, where the communication Network system is an LTE system of a universal mobile telecommunications technology, and the LTE system includes a UE (User Equipment) 201, an E-UTRAN (Evolved UMTS Terrestrial Radio Access Network) 202, an EPC (Evolved Packet Core) 203, and anIP service 204 of an operator, which are in communication connection in sequence.

Specifically, the UE201 may be the terminal 100 described above, and is not described herein again.

The E-UTRAN202 includes eNodeB2021 andother eNodeBs 2022, among others. Among them, the eNodeB2021 may be connected with other eNodeB2022 through backhaul (e.g., X2 interface), the eNodeB2021 is connected to the EPC203, and the eNodeB2021 may provide the UE201 access to theEPC 203.

The EPC203 may include an MME (Mobility Management Entity) 2031, an HSS (Home Subscriber Server) 2032,other MMEs 2033, an SGW (Serving gateway) 2034, a PGW (PDN gateway) 2035, and a PCRF (Policy and Charging Rules Function) 2036, and the like. The MME2031 is a control node that handles signaling between the UE201 and the EPC203, and provides bearer and connection management. HSS2032 is used to provide registers to manage functions such as home location register (not shown) and holds subscriber specific information about service characteristics, data rates, etc. All user data may be sent through SGW2034, PGW2035 may provide IP address assignment for UE201 and other functions, and PCRF2036 is a policy and charging control policy decision point for traffic data flow and IP bearer resources, which selects and provides available policy and charging control decisions for a policy and charging enforcement function (not shown).

TheIP services 204 may include the internet, intranets, IMS (IP Multimedia Subsystem), or other IP services, among others.

Although the LTE system is described as an example, it should be understood by those skilled in the art that the present invention is not limited to the LTE system, but may also be applied to other wireless communication systems, such as GSM, CDMA2000, WCDMA, TD-SCDMA, and future new network systems.

Based on the above-mentioned mobile terminal hardware structure and communication network system, various embodiments of the present invention are proposed.

First embodiment

According to a first embodiment of the present invention, a method for monitoring file creation information is provided, specifically, fig. 3 is a flowchart of the method for monitoring file creation information according to the first embodiment of the present invention, and fig. 4 is a schematic structural diagram of the first implementation of the present invention; as shown in fig. 3 and 4, the method for listening to file creation information according to the first embodiment of the present invention includes the following processes:

step 301: and monitoring the file creating operation of the bottom layer through a monitoring program added at the bottom layer, and acquiring the ID of the application program for creating the file.

Specifically, the file creation operation of the bottom layer is monitored through a monitoring code preset at the bottom layer, the ID of the application program creating the file is acquired, and the ID is sent to the monitoring service module (monitoring service in fig. 4). Lower layers may also be referred to as lower layer libraries in this application.

Specifically, the id (application id) of the application is an identity of the application.

Optionally, when the application is an Android application, the bottom layer is a bionic library. Android is well known to use an open source Linux kernel, and Google has enhanced something for the Linux kernel, developing the Bionic library itself. The Bionic library is only 200KB in size, half the volume of the GNU version, which means higher efficiency and low memory footprint.

Since the code of both java layer and c + + layer is calling the bottom interface (such as bionic interface) to implement the file operation, we can completely monitor the creation action of all files. Specifically, the Java calls the underlying interface through a dynamic link library, and in windows, the underlying interface is a dll file, and linux is a so file.

Step 302: and obtaining the package name of the application program for creating the file according to the ID of the application program.

Specifically, the monitoring service module obtains the package name of the application program for creating the file according to the ID of the application program for creating the file.

Specifically, the package name of the application is the package name of the application, and the package name of the application can be obtained according to the ID of the application through the system service of the android. As a specific example, the package name of the application program may be obtained from the ID of the application program by using a memory hash table, where the memory hash table is a relational table for storing a correspondence between the package name of the application program and the ID of the application program, and the correspondence stored in the memory hash table may be regarded as a fixed unique relationship between the package name of the application program and the ID of the application program in the hash table. Because the content stored in the memory hash table is limited, in order to update the corresponding relationship between the package name of the application program and the ID of the application program in the memory hash table in real time, the information of the application program which is not used or used is properly cleared, and a space is left for storing the information of some common application programs.

Step 303: and sending a notification message that the application program corresponding to the package name carries out file creation to a specified monitoring registrant.

Specifically, the designated listening registrant includes: and the external management program is subjected to monitoring registration in advance and gives an instruction of the application program needing monitoring, namely the external management program is subjected to monitoring registration in advance and instructs to monitor the creation of the application program file.

For example, the application indication specifies an application aspect that includes: the monitoring method comprises the following steps of monitoring all application programs in the whole time period, monitoring one or more application programs in the whole time period, monitoring all application programs in the preset time period, and monitoring one or more application programs in the preset time period. Wherein the specification of the application indication in terms of indication includes a name of the application or a package name of the application, or the like.

Specifically, in the first embodiment, the application program indicates that the application program is a package name of the application program in terms of indication, when file creation information of all application programs in a whole time period needs to be monitored, after the monitoring service module obtains the package name of the application program for creating a file, a corresponding application program is obtained according to the package name, a file created by the corresponding application program is sent to the external management program as a notification message, and after the external management program receives the notification message, 1 is added to the number of files created by the corresponding application program; when file creation information of one or more application programs in all time periods needs to be monitored, after a monitoring service module obtains a package name of the application program for creating the file, whether the application program corresponding to the package name is consistent with the one or more application programs needing to be monitored or not is judged, when the package name is consistent with the package name, a file created by the application program needing to be monitored can be sent to an external management program as a notification message, and after the external management program receives the notification message, the number of the application program created files is added by 1.

In this embodiment, the external manager may register a listener with the listening service module and activate a listening function. Specifically, the memory cannot be shared between the application programs in the android system. Data exchange between different applications is a cross-process. There are 4 ways for cross-process communication provided in android SDKs. These 4 ways correspond exactly to the 4 application components in the android system: activity, Content Provider, Broadcast and Service. Wherein Activity can invoke Activity of other applications across processes; the Content Provider can access data in other application programs (returned in a Cursor object form) in a cross-process manner, and can also perform addition, deletion and modification operations on the data of other application programs; the Broadcast can send broadcasts to all application programs in the android system, and the application programs needing cross-process communication can monitor the broadcasts; the Service is similar to the Content Provider, and can also access data in other application programs, but the difference is that the Content Provider returns a current object, the Service returns a Java object, and the Service capable of cross-process communication is called AIDL Service.

The method for monitoring file creation information according to the first embodiment of the present invention may obtain an ID of an application program that creates a file by monitoring an operation that creates a file, obtain a package name of the application program according to the ID of the application program, and send a notification message that the application program corresponding to the package name has performed file creation to a specified monitoring registrar, so that an external management program can obtain the number of files created by the application program, and may further perform big data analysis, thereby deriving more usages.

Second embodiment

According to a second embodiment of the present invention, a method for monitoring file creation information is provided. The second embodiment is different from the first embodiment in that a file creation operation of the listening infrastructure is specified in more detail in the second embodiment.

The method for monitoring file creation information according to the second embodiment of the present invention includes the following processes:

step 1: snoop codes are written in the bottom layer. Specifically, the bottom layer is a bionic library.

Step 2: and monitoring all file creation operations, and when monitoring that a file creation function (such as an open function) in the bottom layer is called, acquiring the ID of the application program for creating the file by using the monitoring code, and sending the ID to a monitoring service module.

Specifically, the bionic library includes various file operation functions, such as a file creation function, a file modification function, and a file deletion function. Since the code of both java layer and c + + layer is calling the underlying library interface (such as bionic interface) to implement the file operation, we can completely monitor the operation actions of all files (including creating files, changing files, deleting files, etc.).

And step 3: and the monitoring service module obtains the packet name of the application program of the created file according to the ID of the application program of the created file. Specifically, the package name of the application is the package name of the application, and the package name of the application can be obtained according to the ID of the application through the system service of the android.

And 4, step 4: and the monitoring service module sends a notification message that the application program corresponding to the package name carries out file creation to a specified monitoring registrant. Specifically, the designated listening registrant includes: and the external management program is subjected to monitoring registration in advance and gives an instruction of the application program needing monitoring, namely the external management program is subjected to monitoring registration in advance and instructs to monitor the creation of the application program file.

The method for monitoring file creation information according to the second embodiment of the present invention may also obtain an ID of an application program that creates a file by monitoring an operation that creates a file, obtain a package name of the application program according to the ID of the application program, and send a notification message that the application program corresponding to the package name has performed file creation to a specified monitoring registrar, so that an external management program can obtain the number of files created by the application program, and may further perform big data analysis, thereby deriving more usages.

Third embodiment

According to a third embodiment of the present invention, there is provided a method for monitoring file creation information, where the third embodiment is different from the second embodiment in that, when monitoring an underlying file creation operation in the third embodiment, the method further includes: obtaining the name of the created file, further, the notification message further includes: the name of the file is created.

Specifically, the method for monitoring file creation information according to the third embodiment of the present invention includes the following steps:

step 1: snoop codes are written in the bottom layer. Specifically, the bottom layer is a bionic library.

Step 2: and monitoring all file creation operations, and when monitoring that a file creation function (such as an open function) in the bottom layer is called, acquiring the ID of an application program for creating the file and the name of the created file by using the monitoring code, and sending the ID and the name to a monitoring service module.

File manipulation functions, such as a function to create a file, a function to alter a file, and a function to delete a file, are included in the Bionic library. Since the code of both java layer and c + + layer is calling the underlying library interface (such as bionic interface) to implement the file operation, we can completely monitor the operation actions of all files (including creating files, changing files, deleting files, etc.).

Specifically, it is a conventional technical means in the art to obtain the name of the created file according to the monitoring code, and the details are not repeated in the present invention.

And step 3: and the monitoring service module obtains the packet name of the application program of the created file according to the ID of the application program of the created file.

And 4, step 4: sending a notification message that the application program corresponding to the package name performs file creation to a specified monitoring registrant, wherein the notification message further comprises: the name of the file is created.

Specifically, in this example, the application indicates that the indication is specified as the package name of the application, the file creation information of all applications in the entire time period needs to be monitored, when the monitoring service module obtains the package name of the application creating the file, the package name of the application creating the file and the name of the created file are sent to the external management program as notification messages, and the external management program counts the number of the created files of the application according to the received notification messages.

The third embodiment of the present invention provides a method for monitoring file creation information, where a package name of an application program that creates a file and a name of the created file are directly sent to an external management program as notification messages, so that the external management program can classify the created file according to the package name of the application program, and obtain the number of created files of a certain application program.

Fourth embodiment

According to a fourth embodiment of the present invention, a method for monitoring file creation information is provided. The difference between the fourth embodiment and the third embodiment is that in step 4, it is necessary to listen to the file creation information of one or several applications in the whole time period in this embodiment.

The method for monitoring file creation information according to the fourth embodiment of the present invention includes the following processes:

step 1: snoop codes are written in the bottom layer. Specifically, the bottom layer is a bionic library.

Step 2: and monitoring all file creation operations, and when monitoring that a file creation function (such as an open function) in the bottom layer is called, acquiring the ID of an application program for creating the file and the name of the created file by using the monitoring code, and sending the ID and the name to a monitoring service module.

And step 3: and the monitoring service module obtains the packet name of the application program of the created file according to the ID of the application program of the created file.

And 4, step 4: sending a notification message that the application program corresponding to the package name performs file creation to a specified monitoring registrant, wherein the notification message further comprises: the name of the file is created.

In this embodiment, file creation information of several applications in a whole time period needs to be monitored, an application indicates that a packet name specified as an application in terms of indication is the packet name of the application, after a monitoring service module obtains the packet name of the application creating a file, it is determined whether the application corresponding to the packet name is consistent with the application needing to be monitored, when the application corresponding to the packet name is consistent with the application needing to be monitored, the packet name of the application creating a file and the name of the creating file can be sent to an external management program as notification messages, and the external management program counts the number of files created by the application according to the received notification messages.

For example, the external management program is nubia bovine shield, for example, when file creation information of three application programs of QQ, wechat and pay treasure needs to be monitored, names of QQ, wechat and pay treasure may be input in the external management program, and the external management program obtains a package name of the application program according to the input name of the application program and sends the package name of the application program to the monitoring service module. The monitoring service module receives the QQ, the WeChat and the Payment packet name sent by an external management program, and reports the monitored packet name of the application program and the name of the created file to the external management program when the monitored packet name of the application program creating the file is any one of the QQ, the WeChat or the Payment packet name.

The method for monitoring file creation information according to the fourth embodiment of the present invention directly sends the package name of the specific application program that creates the file and the name of the created file to the external management program as notification messages, so that the external management program can classify the created file according to the package name of the specific application program, thereby obtaining the number of the created files of the specific application program.

Fifth embodiment

According to a fifth embodiment of the present invention, a method for monitoring file creation information is provided, and the fifth embodiment is different from the fourth embodiment in that in step 2 and step 4, file creation information of several applications in a certain time period needs to be monitored.

In this embodiment, step 2 includes the following steps: and monitoring all operations for creating files, and when it is monitored that a file creating function (such as an open function) in the bottom layer is called, acquiring the ID of an application program for creating the files, the name of the created files and the time for creating the files by using the monitoring code, and sending the ID, the name and the time to the monitoring service module.

In this embodiment, step 4 includes the following steps: the method comprises the steps that file creation information of an application program in a certain time period needs to be monitored, the application program indicates that the specification in the aspect of indication is the package name and the time period of the application program, when a monitoring service module obtains the package name and the time period of the application program for creating files, whether the application program corresponding to the package name is consistent with the application program needing to be monitored is judged, whether the time for creating the files is in the time period is judged, when the two requirements are met, the package name of the application program for creating the files, the name of the created files and the time for creating the files can be sent to an external management program as notification messages, and the external management program counts the number of the files created by the application program according to the received notification messages.

For example, the external hypervisor is nubia shield. For example, when file creation information of WeChat between 5/month 1 in 2017 and 5/month 10 in 2017 needs to be monitored, the WeChat and the WeChat between 5/month 1 in 2017 and 5/month 10 in 2017 can be input into the external management program, and the external management program sends the time period and the WeChat to the monitoring service module. And the monitoring service module receives the time period sent by the external management program, and reports the monitored package name of the application program, the name of the created file and the time for creating the file to the external management program when the monitored time for creating the file is in the time period.

The method for monitoring file creation information according to the fifth embodiment of the present invention directly sends the package name of the application program that creates the file, the name of the created file, and the time of creating the file to the external management program as notification messages, so that the external management program can classify the created file according to the package name of the application program, and obtain the number of created files in a specific time period of an application program.

Sixth embodiment

According to a fifth embodiment of the present invention, there is provided a method for monitoring file creation information, where the sixth embodiment is different from the fourth embodiment in that after obtaining a package name of an application program that creates a file according to an ID of the application program, the method further includes the following steps:

saving one or more of the following: an ID of an application that created the file, a package name of an application that created the file, and a name of the created file.

The method for monitoring file creation information according to the sixth embodiment of the present invention not only enables an external management program to classify created files according to packet names of application programs to obtain the number of created files in a specific time period of an application program, but also stores monitored data in a database inside a monitoring service module for later use in information statistics.

The method for monitoring file creation information according to the first to sixth embodiments of the present invention may obtain an ID of an application program that creates a file by monitoring a file creation operation, further obtain a package name of the application program according to the ID of the application program, and report the package name of the application program that creates the file and a name of a corresponding created file according to the monitoring request, so that an external management program may distinguish different files according to the package name of the application program after obtaining the reported information, for example, may further perform big data analysis, or prepare for subsequent "clean unloading", thereby deriving more usages.

Corresponding to the method for monitoring file creation information in the first embodiment, the present invention further provides a device for monitoring file creation information, where the device for monitoring file creation information includes: a memory, a processor, and a computer program stored on the memory and executable on the processor, the computer program when executed by the processor comprising the steps of:

step 301: and monitoring the file creating operation of the bottom layer through a monitoring program added at the bottom layer, and acquiring the ID of the application program for creating the file.

Specifically, the id (application id) of the application is an identity of the application.

Optionally, when the application is an Android application, the bottom layer is a bionic library. Since the code of both java layer and c + + layer is calling the bottom interface (such as bionic interface) to implement the file operation, we can completely monitor the creation action of all files.

Step 302: and obtaining the package name of the application program for creating the file according to the ID of the application program.

Specifically, the monitoring service module obtains the package name of the application program for creating the file according to the ID of the application program for creating the file. The package name of the application program is the package name of the application program, and the package name of the application program can be obtained through the android system service according to the ID of the application program.

Step 303: and sending a notification message that the application program corresponding to the package name carries out file creation to a specified monitoring registrant.

Specifically, the designated listening registrant includes: and the external management program is subjected to monitoring registration in advance and gives an instruction of the application program needing monitoring, namely the external management program is subjected to monitoring registration in advance and instructs to monitor the creation of the application program file.

Corresponding to the above-mentioned file creation information monitoring methods of the second embodiment, the third embodiment, the fourth embodiment, the fifth embodiment, and the sixth embodiment, respectively, the present invention further provides a file creation information monitoring device, where the file creation information monitoring device includes: a memory, a processor and a computer program stored on the memory and executable on the processor, the computer program, when executed by the processor, implementing the steps of the method for listening for file creation information as in the second, third, fourth, fifth, sixth embodiment.

The monitoring equipment of the file creation information provided by the invention can obtain the ID of the application program for creating the file through monitoring the operation for creating the file, obtain the package name of the application program according to the ID of the application program, and send the notification message that the application program corresponding to the package name carries out file creation to the appointed monitoring registrant, so that the external management program can obtain the number of the files created by the application program, and can further carry out big data analysis, thereby deriving more usages.

Corresponding to the method for monitoring file creation information of the first embodiment, the present invention further provides a storage medium, on which a monitor program of file creation information is stored, and when being executed by a processor, the monitor program of file creation information implements the following steps of the method for monitoring file creation information:

step 301: and monitoring the file creating operation of the bottom layer through a monitoring program added at the bottom layer, and acquiring the ID of the application program for creating the file.

Specifically, the id (application id) of the application is an identity of the application.

Optionally, when the application is an Android application, the bottom layer is a bionic library. Since the code of both java layer and c + + layer is calling the bottom interface (such as bionic interface) to implement the file operation, we can completely monitor the creation action of all files.

Step 302: and obtaining the package name of the application program for creating the file according to the ID of the application program.

Specifically, the monitoring service module obtains the package name of the application program for creating the file according to the ID of the application program for creating the file. The package name of the application program is the package name of the application program, and the package name of the application program can be obtained through the android system service according to the ID of the application program.

Step 303: and sending a notification message that the application program corresponding to the package name carries out file creation to a specified monitoring registrant.

Specifically, the designated listening registrant includes: and the external management program is subjected to monitoring registration in advance and gives an instruction of the application program needing monitoring, namely the external management program is subjected to monitoring registration in advance and instructs to monitor the creation of the application program file.

A storage medium on which a listener of file creation information is stored, the listener of file creation information implementing the steps of the method of listening to file creation information as in the second, third, fourth, fifth, sixth embodiments when executed by a processor, corresponds to the method of listening to file creation information of the second, third, fourth, fifth, sixth embodiments described above, respectively.

The storage medium provided by the invention can obtain the ID of the application program for creating the file by monitoring the operation for creating the file, obtain the package name of the application program according to the ID of the application program, and send the notification message that the application program corresponding to the package name carries out file creation to the appointed monitoring registrant, so that the external management program can obtain the number of the files created by the application program, and can further carry out big data analysis, thereby deriving more usages.

It should be noted that, in this document, the terms "comprises," "comprising," or any other variation thereof, are intended to cover a non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements does not include only those elements but may include other elements not expressly listed or inherent to such process, method, article, or apparatus. Without further limitation, an element defined by the phrase "comprising an … …" does not exclude the presence of other like elements in a process, method, article, or apparatus that comprises the element.

The above-mentioned serial numbers of the embodiments of the present invention are merely for description and do not represent the merits of the embodiments.

Through the above description of the embodiments, those skilled in the art will clearly understand that the method of the above embodiments can be implemented by software plus a necessary general hardware platform, and certainly can also be implemented by hardware, but in many cases, the former is a better implementation manner. Based on such understanding, the technical solutions of the present invention may be embodied in the form of a software product, which is stored in a storage medium (such as ROM/RAM, magnetic disk, optical disk) and includes instructions for enabling a terminal (such as a mobile phone, a computer, a server, an air conditioner, or a network device) to execute the method according to the embodiments of the present invention.

While the present invention has been described with reference to the embodiments shown in the drawings, the present invention is not limited to the embodiments, which are illustrative and not restrictive, and it will be apparent to those skilled in the art that various changes and modifications can be made therein without departing from the spirit and scope of the invention as defined in the appended claims.

Claims (9)

1. A method for monitoring file creation information is characterized by comprising the following steps:

monitoring the file creating operation of the bottom layer through a monitoring program added to the bottom layer, and acquiring the ID of the application program for creating the file;

obtaining the package name of the application program for creating the file according to the ID of the application program; judging whether the application program corresponding to the package name is consistent with one or more application programs needing to be monitored, if so, creating a file of the application program needing to be monitored as a notification message and sending the file to an external management program, and adding 1 to the number of the files created by the application program after the external management program receives the notification message;

sending a notification message that the application program corresponding to the package name carries out file creation to a specified monitoring registrant, so that an external management program can obtain the number of files created by the application program;

wherein the designated listening registrant includes: the external management program is used for carrying out monitoring registration in advance and giving an application program instruction needing monitoring, and the application program instruction comprises the following provisions in terms of application programs: the number of applications that need to be listened to and/or the time period that needs to be listened to.

2. The method for monitoring file creation information according to claim 1, wherein the monitoring of the underlying file creation operation further comprises: acquiring the name of a created file;

the notification message further comprises: the name of the created file.

3. The method for monitoring file creation information according to claim 1 or 2, wherein the step of monitoring the file creation operation of the bottom layer comprises:

and when the file creating function in the bottom library is called, judging that the file creating operation is monitored.

4. The method for monitoring file creation information according to claim 2, wherein, after obtaining the package name of the application program that created the file based on the ID of the application program, the method further comprises:

saving one or more of the following: an ID of an application program creating a file, a package name of the application program creating the file, and a name of the created file.

5. A monitoring device for file creation information is characterized in that the monitoring device for file creation information comprises: a memory, a processor and a computer program stored on the memory and executable on the processor, the computer program when executed by the processor implementing the steps of:

monitoring the file creating operation of the bottom layer through a monitoring program added to the bottom layer, and acquiring the ID of the application program for creating the file;

obtaining the package name of the application program for creating the file according to the ID of the application program; judging whether the application program corresponding to the package name is consistent with one or more application programs needing to be monitored, if so, creating a file of the application program needing to be monitored as a notification message and sending the file to an external management program, and adding 1 to the number of the files created by the application program after the external management program receives the notification message;

sending a notification message that the application program corresponding to the package name carries out file creation to a specified monitoring registrant, so that an external management program can obtain the number of files created by the application program;

wherein the designated listening registrant includes: the external management program is used for carrying out monitoring registration in advance and giving an application program instruction needing monitoring, and the application program instruction comprises the following provisions in terms of application programs: the number of applications that need to be listened to and/or the time period that needs to be listened to.

6. A listening device for file creation information as recited in claim 5 wherein the computer program is executable by the processor to perform the following further steps in listening for an underlying file creation operation:

acquiring the name of a created file;

the notification message further comprises: the name of the created file.

7. A listening device for file creation information as claimed in claim 5, characterized in that the computer program, when being executed by the processor, embodies the following steps:

when a file creating function in the monitoring bottom library is called, judging that the file creating operation is monitored.

8. The apparatus for listening to file creation information of claim 5, wherein the computer program, when executed by the processor, further performs the following steps after obtaining a package name of an application program that creates a file based on the ID of the application program:

saving one or more of the following: an ID of an application program creating a file, a package name of the application program creating the file, and a name of the created file.

9. A storage medium, characterized in that the storage medium has stored thereon a monitor of file creation information, which when executed by a processor implements the steps of the method of monitoring file creation information according to any one of claims 1 to 4.

Images